Re: Missing characters

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Fernando Anchorena wrote:

> I need a helping hand to solve this
>   
>     $name_pro = "VC++ V2.4"
>     print "<td width='200' class='texto2'> <a
> href='page2.php?page=&value=$name_pro'> $name_pro </a> </td>";

1: Ampersands have special meaning in HTML and must be represented by
entities (for the same reason you have to escape $ signs within double
quotes in PHP).

2: Plus signs have special meaning in URLs (they represent spaces). You need
to URL encode them.

3: Raw spaces are not allowed in URLs. You need to URL encode them.

So:

$name_pro = "VC++ V2.4";
$name_pro_url = urlencode($name_pro);
$url = "page2.php?page=&value=$name_pro_url";
$html_url = htmlentities($url);

// Not actually needed in this example as the data doesn't include
// any characters with special meaning in HTML. You do need this if
// you can't ensure that in advance though.
$html_name_pro = htmlentities($name_pro); 

print <<<HERE
<td width="200" class="texto2">
  <a href="$html_url">$html_name_pro</a>
</td>
HERE;

> echo $value ;     //Prints out VC V2.4 and I need VC++ V2.4

You need to run this through htmlentities too, otherwise its very likely (I
can't see your code so I can't say for certain) that you are opening
yourself up to a cross site scripting attack.

-- 
David Dorward       <http://blog.dorward.me.uk/>   <http://dorward.me.uk/>
                     Home is where the ~/.bashrc is

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php


[Index of Archives]     [PHP Home]     [Apache Users]     [PHP on Windows]     [Kernel Newbies]     [PHP Install]     [PHP Classes]     [Pear]     [Postgresql]     [Postgresql PHP]     [PHP on Windows]     [PHP Database Programming]     [PHP SOAP]

  Powered by Linux